Reconcile protected library merges into TreeDX

[adrianwebb]

Outcome

Protected library branch merges are detected automatically, fetched into TreeDX, promoted to the current logical view, fully reindexed, and queued for the canonical R2 file mirror.

Work authority

• Work item / Issue: Closes Reconcile protected library PR merges into the current TreeDX view #160
• Proposal / decision: User-directed completion of Provider-Aware Agent Context and Team Knowledge Architecture integration.
• Assignment / checkpoint: Active Codex task; protected library convergence checkpoint.
• Actor: Codex / OpenAI
• Human authority: @adrianwebb
• Agent / capacity provider: Codex desktop task under @adrianwebb authority
• Exact base ref: staging at e87ed47
• Exact head ref: codex/issue-160-library-remote-reconciliation at 3411303

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Poll ready GitHub library bindings for protected-branch movement, enqueue an idempotent control-plane operation, use assignment-scoped credential delivery to fetch the exact head into TreeDX, promote the logical branch, refresh graph and search, update binding evidence, and enqueue the existing R2 mirror operation. Status: implemented and verified.

Changes and commits

• 3411303 — protected library remote-head scheduler, reconciliation executor, runner registration, and focused acceptance coverage.

Verification

• I ran the narrowest relevant package verification and documented any checks that could not be run.
• npm test — 76 files, 220 tests passed.
• npm run check:file-lengths — passed; no handwritten file exceeds 500 lines.
• npm run build:dist — passed.
• Focused reconciliation and commit replication tests — 7 tests passed.

Risk and rollback

Risk is limited to background reconciliation of ready GitHub-backed TreeDX libraries. Each exact remote head uses a deterministic idempotency key; promotion uses expected-head concurrency control; indexing must verify the exact resolved commit before the binding advances. Roll back by reverting 3411303; no destructive schema migration is involved.

Completion summary

The missing GitHub-to-TreeDX direction is implemented. Existing TreeDX-to-GitHub/R2 replication remains intact, and the new operation hands the reconciled exact head to that established mirror path.

AGPL committer authorization

The authenticated PR author is checked by the repository-owned authorization workflow.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.